The traditional trust model of most existing sensor networks assumes that the owner and deployer of the network is also the collector and consumer of sensor readings. While this makes sense for small, experimental networks, this is likely not to be the case for large scale sensor networks. Programs and projects such as Sensor Networks for Cabled Ocean Observatories, the Environmental Protection Agency's Remote Sensing Information Gateway, Ocean US, The National Office for Integrated and Sustained Ocean Observations, and others are involved in building ocean observatories and systems (including sensor networks) for observing and reporting earth, ocean and atmosphere information needed to address complex environmental problems. The trust model of large scale sensor networks is shaped by two major factors. First, multiple organizations (e.g., government agencies, universities and companies) are involved, acting both as funding sources and primary investigators. Even though network owners need to collaborate for administrative purposes, they may not fully trust each other, due to diverging interests. Second, external organizations interested in the areas monitored by the sensor network may be willing to pay for access to sensor readings. However, providing support for third party (client) queries raises privacy and efficiency issues. Clients may not be willing to disclose areas of interest or access patterns, whereas the owner(s) of the network will want to preserve the network's resources.
Thus, for large-scale networks, it becomes increasingly difficult to keep the locations of such queries confidential. For example, the server may find that the client is interested only in readings from sensors placed in a certain area (e.g., coverage boundary sensors) or that the client is accessing sensor readings only in a certain order (e.g., if the temperature in region Ri is above T, query region Rj, otherwise query region Rk). Additionally, sometimes a user who has the same query to make over and over again, will wish this fact to be hidden from others as well. Therefore, a need exists for a method and apparatus for performing anonymous source routing such that locations of queries can be kept confidential.